Bug 1443668 - [3.5] HAProxy router's request buffer is too small
Summary: [3.5] HAProxy router's request buffer is too small
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Routing
Version: 3.5.1
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 3.5.z
Assignee: Miciah Dashiel Butler Masters
QA Contact: zhaozhanqi
URL:
Whiteboard: aos-scalability-36
Depends On:
Blocks: 1457317
TreeView+ depends on / blocked
 
Reported: 2017-04-19 16:53 UTC by Miciah Dashiel Butler Masters
Modified: 2017-06-15 18:37 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1443665
: 1443675 1457317 (view as bug list)
Environment:
Last Closed: 2017-06-15 18:37:42 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift ose pull 714 0 None None None 2017-04-19 17:47:55 UTC
Red Hat Product Errata RHBA-2017:1425 0 normal SHIPPED_LIVE OpenShift Container Platform 3.5, 3.4, 3.3, and 3.2 bug fix update 2017-06-15 22:35:53 UTC

Description Miciah Dashiel Butler Masters 2017-04-19 16:53:56 UTC
Description of problem:

HAProxy's default request buffer configuration only allows 8192 bytes for headers in incoming requests.  This limit is too low.

haproxy-config.template does not specify tune.bufsize or tune.maxrewrite.  The default value for tune.bufsize is 16384 bytes.  The default value for tune.maxrewrite is half of tune.bufsize.  Incoming request headers are limited to the difference, tune.bufsize - tune.maxrewrite, thus 8192 bytes, by default.


Version-Release number of selected component (if applicable):

v3.5.5.7


Steps to reproduce:

The problem can be demonstrated with the following command:

    curl "http://${some_route}/" -H "X-Foo: $(perl -e 'print "x"x8192')"


Actual results:

HAProxy responds with "400 Bad request".


Expected results:

HAProxy should return a 200 response.


Additional information:

PR: https://github.com/openshift/ose/pull/714

Comment 3 Yan Du 2017-06-05 06:47:24 UTC
Test on OCP 3.5 env
openshift v3.5.5.23
kubernetes v1.5.2+43a9be4

$ curl "http://test-service-d2.0605-rnv.qe.rhcloud.com/" -H "X-Foo: $(perl -e 'print "x"x8192')"
Hello OpenShift!

Comment 5 errata-xmlrpc 2017-06-15 18:37:42 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1425


Note You need to log in before you can comment on or make changes to this bug.